CVE-2026-16569
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.
Risk Assessment
Unauthorized stock changes can lead to incorrect orders, financial losses, and operational issues in the store.
Recommendation
Update the plugin to a version newer than 0.4.62 if available. Restrict access to REST endpoints to appropriately privileged users.
Other vulnerabilities in ShopApper Mobile App Builder
Original NVD description (English source)
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.